The short answer
On 26 August 2026, Island disclosed NovaCookies — a subscription adversary-in-the-middle (AiTM) phishing service that relays Microsoft 365 authentication in real time, capturing the session cookie produced after MFA completes. Sold at $320/month via Telegram, it abuses genuine Docusign notifications as the delivery vector and routes victims through legitimate Microsoft and Google redirect endpoints to maintain apparent trustworthiness until the final relay. Over 755 dedicated malicious domains have been linked to the service, predominantly on the .vu TLD, with hundreds of organizations targeted across the US, UK, Canada, Germany, Israel, and UAE.
For any team that builds on Microsoft 365 — for identity, email, CI/CD service accounts, or admin access — this is a live threat. The commercial model lowers the barrier for attackers to the cost of a SaaS subscription. And because the attack relays real authentication rather than stealing credentials, a thorough security audit of your M365 Conditional Access and session controls is now worth doing before an incident forces the question.
How NovaCookies works
Most phishing attacks target credentials: they show a fake login page and collect whatever the victim types. NovaCookies takes a fundamentally different approach. It acts as a live proxy — a relay — between the victim's browser and Microsoft's real authentication servers. The victim interacts with what looks like a Microsoft 365 sign-in page, enters real credentials and completes real MFA, and Microsoft issues a real session cookie. That cookie is what NovaCookies captures.
From Microsoft's perspective, the login is legitimate: the correct password was supplied, the correct MFA factor was approved, and a session was granted. The session cookie is then handed to the attacker, who can replay it from any location to access the victim's inbox, Teams conversations, SharePoint files, and any connected SaaS applications — with no further authentication required and no malware on any endpoint.
The service is fully managed. Operators host the central relay infrastructure; customers receive a login panel, custom domain options, and Telegram-based support. Island researchers documented the commercial structure as similar to a SaaS business: tiered pricing, domain selection as a product feature, and real-time session management. Proofpoint assessed NovaCookies as a variant of the Sneaky 2FA phishing kit family.
The Docusign delivery chain
What distinguishes NovaCookies from earlier AiTM kits is the sophistication of its delivery. Campaigns begin with genuine Docusign envelopes — emails generated by Docusign's own sending infrastructure embedding a counterfeit document-share link. Because the email originates from Docusign servers, it passes SPF, DKIM, and DMARC checks that most enterprise email security gateways rely on. The message arrives looking exactly like a routine document-signature request.
Clicking the link does not take the victim directly to the attacker's relay. Instead, it routes through one or more legitimate Microsoft or Google OAuth redirect endpoints — a technique that exploits the expected behaviour of document-collaboration flows to add further hops of apparent legitimacy. By the time the victim's browser reaches attacker-controlled infrastructure, they have passed through multiple domains they recognize, and the final sign-in prompt looks identical to a real Microsoft 365 page.
The malicious domains Island documented follow a brand-mimicking pattern: inserted characters or transpositions in recognizable names (e.g., fordmotbvmorcompany[.]vu, morganstbftanley[.]vu), with mixed-case URL paths like /Ms36-AcCeSs/ or /PwPt-sHaRe/ functioning as session tokens. Nearly 90% of the documented infrastructure used .vu domains during the dominant campaign wave, which ran sharply from mid-May 2026 through August 2026.
Why MFA doesn't stop it
This is the point most security guidance misses. AiTM relay attacks do not bypass MFA — they complete it. The victim approves the push notification, enters the TOTP code, or confirms the SMS message against Microsoft's real authentication system. MFA works exactly as designed. The problem is that MFA authenticates the user to Microsoft, not the relay proxy to the user. Once Microsoft issues a session token in response to a valid credential-plus-MFA exchange, NovaCookies captures that token and the attacker inherits the authenticated session.
The only MFA modality that defeats this is phishing-resistant authentication — FIDO2 hardware security keys (YubiKey, Google Titan) or device-bound passkeys. These methods cryptographically bind the authentication assertion to the legitimate origin domain using a private key that never leaves the authenticator. When the relay attempts to forward the authentication request, the signed assertion is specific to Microsoft's domain and cannot be used against a different origin. The relay gets a valid credential exchange, but the resulting assertion is worthless for any domain other than the one it was signed for.
TOTP codes, SMS codes, and push notifications carry no such binding. They authenticate the user; they do not authenticate the channel.
What it means for US & EU enterprise teams
The commercial model is what makes this immediately relevant to teams that might otherwise consider AiTM a nation-state threat. At $320 a month, the technical and financial barrier is lower than many security vendors' per-seat pricing. Any organization that has ever appeared in a data breach, been targeted by a business email compromise attempt, or has employees who routinely sign Docusign documents is a plausible target.
A stolen M365 session is not just an inbox. For most enterprise environments it is a keyring: email, calendar, Teams conversations, SharePoint documents, OneDrive, connected SaaS applications via OAuth, and — critically — any admin portal that trusts the M365 identity. A threat actor with an authenticated session for a developer or DevOps account can reach source repositories, CI/CD secrets, and cloud console access depending on how tightly Conditional Access and privilege are scoped.
For organizations in regulated industries, the legal exposure compounds the operational one. In FinTech, a stolen session that reaches customer financial data triggers GDPR Article 33 breach notification within 72 hours, and potentially PSD2 incident reporting obligations. In healthcare, HIPAA's Breach Notification Rule applies if the session touches protected health information. DORA, effective January 2025, requires financial entities to report significant ICT-related incidents to competent authorities — and an undetected AiTM session running for days before discovery will be difficult to scope in the required incident log. Under SOC 2 readiness assessments, access control findings around phishing-resistant MFA are increasingly flagged as deficiencies rather than recommendations.
Teams that manage software products integrating with M365 via OAuth tokens or that use M365 service accounts for CI/CD or third-party API access have an additional attack surface. A stolen service-account session is often a path to infrastructure that has nothing to do with email.
How to defend your organization
The core defence is architectural: move high-value accounts to phishing-resistant MFA. Everything else is a meaningful mitigation, but not a substitute for removing the relay's ability to steal a usable session.
- Migrate to phishing-resistant MFA for privileged and high-risk accounts. FIDO2 hardware security keys (YubiKey, Google Titan Key) or device-bound passkeys are the only modalities that cryptographically block an AiTM relay. Prioritize admin accounts, developers with cloud console access, and any account whose inbox contains sensitive contracts or credentials.
- Enforce Conditional Access with compliant device requirements. A valid session cookie from an unregistered or non-compliant device should trigger a block or a step-up challenge. This adds a second gate that an attacker replaying a stolen cookie from a fresh machine will likely fail.
- Monitor for session anomalies at authentication time. Impossible travel and sign-ins from unexpected IP geolocations immediately after an authentication event are the strongest real-time signal of a stolen-session replay. Configure alerts, not dashboards — the window for catching a replay before damage is short.
- Treat document-sharing links as an inspection priority. Genuine Docusign links that route through unusual redirect chains or resolve to brand-themed domains on obscure TLDs (
.vu,.xyz) should be sandboxed before the user's browser renders them. Email security gateways that follow link redirects before delivery stop this class of attack at scale. - Require step-up verification for high-risk operations. Admin operations, bulk data exports, financial approval flows, and OAuth consent grants should require re-authentication beyond the existing session, especially for newly established sessions or sessions from unfamiliar devices.
- Scope OAuth and M365 service account permissions tightly. If a developer or service account's session is stolen, least-privilege scoping limits the blast radius. Review whether any service accounts have read-mail, full-mailbox, or SharePoint-admin permissions they do not actually need.
None of this requires rearchitecting identity overnight. A prioritized rollout of FIDO2 hardware keys to the twenty or thirty accounts whose compromise would be highest-impact covers most of the practical risk from a service like NovaCookies, whose campaigns target volume rather than specific individuals. The accounts most worth protecting are the ones that open the most doors.
Frequently asked questions
What is NovaCookies?
NovaCookies is a subscription-based adversary-in-the-middle (AiTM) phishing-as-a-service platform disclosed on 26 August 2026 by Island and covered by The Hacker News. It relays Microsoft 365 authentication in real time, capturing authenticated session cookies after MFA completes. Sold at $320/month or $200 for 14 days via Telegram, the service abuses genuine Docusign notifications as the delivery vector and has targeted hundreds of organizations across the US, UK, Canada, Germany, Israel, and UAE using over 755 dedicated malicious domains.
Does MFA protect against NovaCookies?
Standard MFA — time-based one-time passwords (TOTP), SMS codes, and authenticator push approvals — does not stop NovaCookies. An AiTM relay completes the real Microsoft 365 authentication flow, including MFA, on behalf of the victim. The resulting session cookie belongs to the attacker. The only MFA modality that prevents AiTM attacks is phishing-resistant authentication: FIDO2 hardware security keys or device-bound passkeys, which cryptographically bind the authentication assertion to the legitimate origin domain and cannot be relayed to an attacker's server.
How does NovaCookies use Docusign?
Campaigns begin with genuine Docusign envelopes — real emails sent from Docusign's own infrastructure — that contain malicious document-share links. Because the delivery uses Docusign's legitimate sending infrastructure, sender-authentication checks (SPF, DKIM, DMARC) pass and many email security gateways allow the messages through. Victims clicking the link are routed through legitimate Microsoft or Google OAuth redirect hops before reaching attacker-controlled infrastructure, making each step look plausible in isolation.
Which organizations are targeted?
Island documented hundreds of targeted organizations with approximately half in the United States and secondary concentrations in the United Kingdom, Canada, Germany, Israel, and the UAE. NovaCookies is sector-agnostic: any enterprise using Microsoft 365 for email, collaboration, or identity is a potential target. Organizations in regulated industries — FinTech, healthcare, legal, government contracting — face higher downstream risk because a stolen M365 session can expose sensitive records, triggering breach notification obligations under GDPR, HIPAA, or DORA.
How can enterprise teams defend against AiTM phishing?
The primary technical control is migrating high-value accounts to phishing-resistant MFA: FIDO2 hardware security keys (YubiKey, Google Titan) or device-bound passkeys. Beyond that: enforce Conditional Access with compliant-device requirements so a valid session cookie from an unregistered device triggers a block or step-up challenge; monitor for session anomalies such as logins from unexpected geographic locations immediately after authentication; inspect document-sharing links in email security tools — brand-themed domains on obscure TLDs such as .vu are a strong signal; and treat any high-risk action (admin operations, bulk export, payments) as requiring step-up verification beyond the initial session.
Sources
Island — NovaCookies at Scale: Inside the $320 Phishing Service Targeting Hundreds of Organizations (primary researcher)
The Hacker News — NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions (26 August 2026)